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Purpose 

This guidance implements Executive Order 13556 of November 4, 2010 (the Order). 

Section 2(c) of the Order provides that the National Archives and Records Administration 
(NARA) shall serve as the Executive Agent (EA) to implement the Order and monitor agency 
implementation. Section 4(b) of the Order also requires the EA, in consultation with affected 
agencies, to develop and issue such directives as are necessary to implement the Order. 

Scope 

This guidance applies to agencies that create or handle unclassified information requiring 
safeguarding or dissemination controls pursuant to and consistent with applicable law, 
regulation, or Government-wide policy. 

General Provisions 

Establishment and Management of a CUI Program 

Agency heads shall establish and manage an agency CUI program that develops and implements 
agency procedures, roles, and responsibilities regarding CUI in accordance with the Order and 
this guidance, provides for required training for affected personnel regarding implementation and 
maintenance of the agency’s CUI program in accordance with this guidance, creates a self- 
inspection program to ensure compliance with the Order and this guidance, and designates a 
senior agency official to assist the agency head in CUI implementation and ensure compliance 
with the Order and this guidance. 

Designation of Categories 

Designation of information as CUI shall be limited to unclassified information requiring 
safeguarding or dissemination controls as set forth in law, regulation, or Government- wide 
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policy. Per section 3(b) of the Order, if there is significant doubt about whether information 
should be designated as CUI, it shall not be so designated. 

The EA shall establish the initial CUI categories based on agency submissions in accordance 
with sections 3(a)(2) and 4(a) of the Order. 

Following initial designations, an agency head or the designated senior agency official may 
submit a written request to the EA for addition to or revision of existing CUI categories for 
review and approval. The request shall include the type of information within the agency that 
may meet the requirements for designation as CUI, along with a proposed marking, definition, 
and applicable decontrol period. Each request shall reference the authority for safeguarding or 
dissemination controls pursuant to law, regulation, or Government-wide policy upon which the 
request is based. 

No safeguarding measures or limits on dissemination may be placed upon unclassified 
information as part of the conduct or reporting of federally-funded scientific research, except as 
provided in applicable statutes. 

CUI Registry 

Per section 4(d) of the Order, the EA shall establish and maintain a CUI registry to contain 
authorized CUI categories; subcategories (if necessary); citation of law, regulation, or 
Government-wide policy for each category; associated markings; applicable safeguarding and 
dissemination controls per associated authorities; and applicable decontrol requirements. 

The registry shall also list sanctions specified in applicable statute or regulation along with their 
associated CUI categories. 

The CUI registry shall be available on the NARA website to ensure public accessibility. CUI 
categories may not be used until the phased implementation date for marking, and the marking is 
approved and made available in the CUI registry. 

Markings 

CUI markings are intended to facilitate consistency in information sharing and a common 
understanding of safeguarding and dissemination controls. 

CUI markings are the only markings authorized to designate unclassified information that 
requires safeguarding or dissemination controls. Such markings shall only be authorized when 
controls are required pursuant to and consistent with applicable law, regulations, and 
Government- wide policies. 

Approved CUI markings shall be listed in the CUI registry. 
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All CUI markings shall be clearly applied and easily identified using the format in this guidance. 
Should there be extraordinary circumstances that require flexible marking practices, an agency 
head, or the designated senior agency official, shall submit a written request to the EA for 
consideration and approval of alternative methods. 

The following shall be the only approved overall marking format for CUI: 

CUE/ Authorized Category-Subcategory (if necessary) 

The EA, in consultation with affected agencies, shall issue guidance regarding the appropriate 
CUI markings and placement for various types of media. 

Commingling CUI with classified national security information is authorized and when 
performed shall adhere to this guidance, as well as 32 C.E.R. Part 2001, or other issuances 
pursuant to Executive Order 13526 or a successor executive order. 

Portion Markings 

Portion marking is encouraged to facilitate information sharing and proper application of 
controls for CUI. Should agencies employ portion marking as a part of their information 
protection program, portion markings shall be placed before each section of the document 
containing CUI. 

The following format shall be the only approved portion marking format for CUI: 
(CUE/Authorized Category-Subcategory (if necessary)) 

Re-marking of Eegacy Material 

Agencies are not required to redact or re-mark legacy material when transferred to the physical 
or legal custody of NARA. 

When legacy material is re-used, in whole or in part, legacy markings shall not be carried 
forward. 

If a legacy document is re-used in its entirety and the information meets the standards for 
designation as CUI, any legacy markings shall be either struck through with a single straight line, 
or removed via electronic measures. Should striking through or removing the legacy marking 
not be practicable, an accompanying statement will indicate the appropriate CUI marking, and 
specify that the former marking is invalid. When legacy material is incorporated, paraphrased, 
or restated in part, the appropriate CUI marking shall be applied only if the information meets 
the requirements for designation as CUI. 
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Safeguarding 



Agencies shall employ safeguarding measures and controls to protect CUI from unauthorized 
access, and to manage the risks associated with the processing, storage, handling, transmission, 
and destruction of CUI. Agencies shall ensure that all safeguarding measures are consistent with 
existing federal requirements and guidelines for CUI, including Office of Management and 
Budget (0MB) policies and National Institute of Standards and Technology (NIST) standards 
and guidelines, per section 6(a)(3) of the Order. 

When law, regulation, or Government- wide policy mandates specific requirements for the 
safeguarding of a particular category or subcategory of CUI, these requirements shall be 
published in the CUI registry. 

All persons responsible for the processing, storage, handling, transmission, or destruction of CUI 
shall take appropriate measures to prevent unauthorized access or use. 

Agency-specific safeguarding controls that exceed those published in the CUI registry shall not 
be imposed on users outside of the implementing agency. 

Dissemination 



Should a law, regulation, or Government-wide policy include dissemination controls, these 
specific instructions shall be followed and made available for reference in the CUI registry. In 
the absence of specific dissemination controls per associated authorities, agencies shall 
disseminate CUI only to individuals who require the information for an authorized mission 
purpose. 

The mere fact that information is designated as CUI shall not have a bearing on determinations 
pursuant to the Freedom of Information Act (FOIA), or any law requiring the disclosure of 
information or permitting disclosure as a matter of discretion, including disclosures to the 
legislative or judicial branches, in accordance with section 2(b) of the Order. 

Decontrol 



CUI shall be decontrolled as soon as possible when it no longer requires safeguarding measures 
and dissemination controls pursuant to its associated authorities. CUI may not be controlled 
indefinitely unless law, regulation, or Government-wide policy so stipulates. Each category in 
the registry shall indicate a specific time frame or event for applicable decontrol. 

No action is necessary when CUI is decontrolled unless the information has been incorporated, 
restated, paraphrased, or re-used. In these cases, the CUI marking shall be either struck through 
with a single straight line, or removed via electronic measures. 

4 




Decontrol does not constitute public release of GUI. Public release shall be in accordance with 
law, regulation, and agency-specific procedures. GUI shall be decontrolled before, or no later 
than, the time of authorized public release. 

Education and Training 

At a minimum, agencies shall ensure that their personnel who create or handle GUI have a 
satisfactory knowledge and understanding of relevant GUI categories and associated markings, 
as well as applicable safeguarding, dissemination, and decontrol policies and procedures. 

Initial and refresher training shall be tailored to meet the specific needs of the agency and the 
activities that personnel are expected to perform as determined by the individual agency. 

Agency programs developed pursuant to this guidance shall include the means, methods, and 
frequency for providing GUI training. 

Agency Self- Inspections 

Agency heads shall create a self-inspection program that adheres to the principles and 
requirements of the Order and this guidance, develop self-inspection methods, including reviews 
and assessments, to evaluate program effectiveness, measure the level of compliance with the 
Order and this guidance, and monitor the progress of GUI implementation. Agency self- 
inspection programs shall also integrate lessons learned from reviews and assessments to 
improve operational policies, procedures, and training, establish a system for corrective action to 
prevent and respond to non-compliance with the Order and this guidance, and provide 
documentation that reflects the analysis and conclusions of the self-inspection program to the EA 
on an annual basis and as requested by the EA. 

Executive Agent Responsibilities 

Implementation 

The EA shall review compliance plans submitted by the agencies per sections 5(a) and 5(b) of 
the Order to monitor progress towards proper implementation of the Order and this guidance. 
Eollowing this review, and in consultation with affected agencies and 0MB, the EA shall 
establish deadlines for phased implementation based on agency submissions per section 5(b) of 
the Order. 

The EA shall issue additional notices and guidance as needed for implementation of the Order, as 
well as for establishing and maintaining agency GUI programs. Such additional notices and 
guidance shall be developed in consultation with affected agencies as well as representatives of 
the public and State, local, tribal, and private sector partners. 
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Oversight 

The EA shall conduct oversight to ensure that agencies have comprehensive programs in place 
for implementation of and compliance with the Order and this guidance. Upon request of the 
EA, agencies shall provide an update of CUI implementation efforts for subsequent reporting as 
required by section 5(c) of the Order. EA oversight may include conducting formal reviews, on- 
site liaison visits, and audits throughout the executive branch to evaluate agency CUI 
implementation, identifying information handling procedures or issues that require corrective 
actions, providing guidance and assistance, and conducting inquiries in response to pertinent 
notifications or complaints. 

Additional Information 

Dispute Resolution 

Agencies involved in a dispute arising from an agency’s implementation of the Order and this 
guidance shall make every effort to resolve the dispute expeditiously. Disputes should be 
resolved within a mutually- agreed upon time period, taking into consideration the mission, 
sharing, and protection requirements of the parties concerned. 

If agencies party to a dispute cannot reach a mutually acceptable resolution, the dispute may be 
referred to the EA. The EA shall act as the impartial arbiter of the dispute. If a party to the 
dispute is a member of the Intelligence Community, the EA shall consult with the Office of the 
Director of National Intelligence. 

If the EA and an agency cannot reach an agreement on an issue related to the implementation of 
the Order or this guidance, an appeal may be made to the President through the Director of 0MB 
for resolution per section 4(e) of the Order. 

Transfer of Records to NARA 



When records, as defined by 44 U.S.C. 3301, containing CUI are transferred to the physical or 
legal custody of NARA, the agency shall inform NARA of the continued control of such records 
through an indicator on the Records Transmittal and Receipt (SE-135) or the Agreement to 
Transfer Records to The National Archives of The United States (SE-258). Additionally, when a 
physical transfer of records occurs, the appropriate CUI marking shall be placed on the outside of 
the box to indicate that information designated as CUI is enclosed. 

If such an indication is not made on one of the aforementioned forms, the information shall be 
presumed to have been decontrolled prior to transfer, regardless of any CUI markings on the 
records. 
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Definitions 



Agency means any “Executive agency,” as defined in 5 U.S.C. 105, and the United States Postal 
Service; any “Military Department” as defined in 5 U.S.C. 102; and any other entity within the 
executive branch that uses, handles, or stores CUE 

Associated authority means any law, regulation, or Government- wide policy that requires 
safeguarding and/or dissemination controls for such information that has been categorized as 
CUI. 

Controlled Unclassified Information (CUI) means unclassified information that requires 
safeguarding or dissemination controls pursuant to and consistent with applicable law, 
regulation, and Government- wide policy. 

CUI categories means the exclusive designations for identifying and organizing types of 
unclassified information that meet the standard for CUI. 

CUI registry means the public listing of authorized CUI categories and subcategories, citations 
of applicable law, regulation, and Government- wide policy for each category, associated 
markings, and applicable safeguarding, dissemination, and decontrol requirements. 

Decontrolled means that the information is no longer subject to CUI safeguarding and/or 
dissemination controls. 

Dissemination means the authorized sharing of CUI amongst parties to include executive branch 
agencies and State, local, tribal, and private sector partners, but does not include disclosure in 
response to a request under the Freedom of Information Act. 

Government-wide policy means a formal, written issuance including, but not limited to, an 
Executive Order, 0MB policy, or NIST standards and guidelines that explicitly applies to 
executive branch agencies. 

Information means any knowledge that can be communicated or documentary material, 
regardless of its physical form or characteristics, that is owned by, is produced by or for, or is 
under the control of the United States Government. 

Legacy material means sensitive unclassified material that was previously marked under agency- 
specific marking practices. 

Portion marking means placing a parenthetical symbol immediately preceding those sections of a 
document containing CUI to indicate the applicable CUI category. 
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Public Release means the act of making information available to the general public through the 
approved processes of an agency. 

Safeguarding means measures and controls that are prescribed to protect CUI from unauthorized 
access and to manage the risks associated with processing, storage, handling, transmission, and 
destruction of CUI. 



Please direct any questions regarding this Controlled Unclassified Information Office 
Notice to: cui@nara.gov. 
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